I'm training my SQLInjection knowledge on a training tool made by my university.
In a certain lvl there is this simple product viewer which gets a row based on a id.
So the query should me something like SELECT * FROM products WHERE id = ?
There is a simple security layer which filters some chars (and char combinations) like OR and such.
The following input gets me four results instead of one:
1 | 1 is not null
GOAL: get the users pass
Additional info: There is a user table with a password column. The wanted user has the 'name' 'Piet'
How could I get my injection to work such that it will return the password somewhere?