I am doing a SQL injection training with TryHackMe as shown below. https://tryhackme.com/room/ccpentesting task 18

I am trying to do it the manual way. From the guide online I know that to get the SQL version in MySQL we can use SELECT @@version. However when I try it, it says I have syntax error.

enter image description here

Update: I was able get rid of the syntax error by adding a space at the end --' to -- '

enter image description here

however I cant see any output

  • 1
    1. Are you sure that the target is MySQL? 2. Look very carefully at the message and make sure you read the text slowly. Do you see the quote marks it reports back to you?
    – schroeder
    Aug 1 '21 at 7:52
  • 1
    The error message says it is Mysql. Select * may return any number of fields whereas @@version returns only one. The UNION query requires that all selects return the same number of fields (in compatible formats). You probably need to add more dummy fields until you find the correct number of fields returned by the query.
    – Kate
    Aug 1 '21 at 17:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.