> For the complete documentation index, see [llms.txt](https://dev-angelist.gitbook.io/writeups-and-walkthroughs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dev-angelist.gitbook.io/writeups-and-walkthroughs/portswigger-web-security-academy/essential-skills/obfuscating-attacks-using-encodings/sql-injection-with-filter-bypass-via-xml-encoding.md). # SQL injection with filter bypass via XML encoding https\://portswigger.net/web-security/sql-injection/lab-sql-injection-with-filter-bypass-via-xml-encoding ## Description This lab contains a SQL injection vulnerability in its stock check feature. The results from the query are returned in the application's response, so you can use a UNION attack to retrieve data from other tables. The database contains a `users` table, which contains the usernames and passwords of registered users. To solve the lab, perform a SQL injection attack to retrieve the admin user's credentials, then log in to their account. ## Solution
Click to one of products shop:
Analyzing HTTP request of this request with BurpSuite there're not XML, so this is the wrong via.
See well the page, there's a form with a method POST that permits to display the stock value of relative product in three various store place.
Capturing it, we can see the XML that we're searching!
We can start trying to injecting this payload: `1 UNION SELECT NULL` for understand if the print of 'NULL' value will be executed
WAF identify a malicious payload, so we can try to encode our payload using tools Install HackVector (Optional), we can use other web tools
Encoding the payload to HEX\_EntitIes: `1 <@hex_entities>UNION SELECT NULL` \ `` we're able to evade WAF and obtain 'NULL' as result:
So, adding a new one 'NULL' value we can see that the 2nd new column doesn't exists, than the table's column are only one,
remembering the task there're not problem "The database contains a `users` table, which contains the usernames and passwords of registered users. ", column requested are two, we can ovviate to this thing concatening the two parameters: 1 <@hex\_entities>UNION SELECT username || '\~' || password FROM USERS \ \
and obtaining credentials for login and complete the lab.