SQLi 101
Tags: cybersecurity, webdev, beginners, tutorial
Published: 2023-08-30 02:05:24

### Introduction
In this blog post, I’d like to share how I solved [PortSwigger Academy](https://portswigger.net/web-security/all-labs#sql-injection) APPRENTICE SQLi lab 1.

### Problem Statement (Lab 1)
This lab contains a SQL injection vulnerability in the product category filter. When the user selects a category, the application carries out an SQL query like the following:

> SELECT * FROM products WHERE category = 'Gifts' AND released = 1

To solve the lab, perform an SQL injection attack that causes the application to display one or more unreleased products.

### Pre-requisite Knowledge
To solve these labs, you need to know:

what SQL injection is, how it can be performed, etc.
How to use BurpSuite or Zap? (whichever you may prefer)

**What is SQL injection or SQLi?**

SQL injection is a web security vulnerability that enables an attacker to interfere with the queries that an application makes to its database. This vulnerability generally allows an attacker to view data that they are not normally able to retrieve. In many cases, an attacker can modify or delete this data, causing persistent changes to the application’s content or behaviour.

**BurpSuite**

The community edition of BurpSuite is free to use and can be downloaded from their website, but it has limited functionality.

**OWASP ZAP**

It is a free easy-to-use, open-source alternative to BurpSuite. It doesn’t have as many features as the pro edition of BurpSuite, but it is beginner-friendly.

### Solving Lab 1


![Picture of Lab](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/y0qbuk94eybw1ck3gpep.png)

### Setting up the Environment

1. For solving this lab we need to use Firefox as most chromium based browsers don’t allow us to setup custom proxies.
2. On Firefox, install the extension foxy-proxy. This saves us the effort of changing the proxy manually every time we want to do the lab.
3. To setup foxy-proxy: click on foxy-proxy -> select options -> click on add -> give any name -> set the proxy type as HTTP, set proxy IP address as 127.0.0.1 and the port number as 8080 and save it.
4. Now each time you want to use BurpSuite on the lab, you just need to activate the proxy we’ve just created, rather than going into settings and manually changing it.
5. Now Open BurpSuite.

#### Aim
To perform an SQL injection attack that causes the application to display one or more unreleased products.

#### Things we know
When the user selects a category, the application carries out an SQL query like the following:
> SELECT * FROM products WHERE category = 'Gifts' AND released = 1

#### Approach 
- We want to display unreleased products and based on the given information we know that whenever a user clicks on a category of product the query is

```
category = 'Category selected by the user' AND released = 1
```
- So all we need to do is edit the query such that released = 1 a portion of the query is not executed.
- To prevent a line of code from executing we can comment it out.
- Comment in SQL is represented by 

> 
--

#### The Process
1. Open BurpSuite
2. Click on the proxy in the top ribbon and set intercept as on
3. In the browser, turn on the proxy we had setup
4. Click on any of the categories displayed on the lab website
5. Now under the proxy tab, you can see something similar to this
![BurpSuite Proxy Tab](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4anf8ukx390tcboor9lb.png)
6. Now right-click in this raw area
7. Select send to repeater
8. After the category add ```' OR 1=1-- ``` and click on send.
9. Voila! the lab is solved.
10. Turn off the proxy and reload the lab to see the final output.

![BurpSuite Repeater Tab](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fi31pmkm4iwsuflqoebs.png)
#### Output

![Lab Solved!](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wlwmtctd6iyhtpal9zdb.png)

#### Lessons Learned
1. SQLi is a pretty common vulnerability that can be avoided by sanitizing the data.
2. When taking inputs from the user, we should white list certain inputs and the inputs in the white list should only be allowed to be entered by the user.

#### Other methods
1. We can perform SQLi using scripts
2. Using OWASP ZAP: using OWAZP ZAP is much easier, we don’t need to setup foxy-proxy while using ZAP.
3. There might me many more methods out the to perform SQLi, am just a beginner and I’ve tried to share my learning using simple words.

##### Author's Note
This is my first time writing an article and publishing it on a platform like article, so please make sure to add comments on how can I improve my writing and please support my work.