https://blog.mingon.dev/tags/union-based/Recent content in UNION-Based on 보안 연구 노트Hugo -- gohugo.ioko-KRThu, 21 May 2026 19:00:00 +0900https://blog.mingon.dev/write-up/portswigger/sql-injection/write-up-portswigger---sql-injection-with-filter-bypass-via-xml-encoding/Thu, 21 May 2026 19:00:00 +0900https://blog.mingon.dev/write-up/portswigger/sql-injection/write-up-portswigger---sql-injection-with-filter-bypass-via-xml-encoding/XML 입력을 파싱하기 전에 SQL 키워드를 차단하는 WAF를, 문자 엔티티 인코딩(파싱 불일치)으로 우회해 UNION 공격으로 administrator 계정 정보를 탈취하는 풀이https://blog.mingon.dev/write-up/portswigger/sql-injection/write-up-portswigger---sql-injection-union-attack-retrieving-multiple-values-in-a-single-column/Thu, 21 May 2026 10:00:00 +0900https://blog.mingon.dev/write-up/portswigger/sql-injection/write-up-portswigger---sql-injection-union-attack-retrieving-multiple-values-in-a-single-column/문자열 컬럼이 하나뿐인 상황에서 문자열 연결 연산자로 username과 password를 하나의 컬럼에 합쳐 조회하는 PortSwigger 랩 풀이https://blog.mingon.dev/write-up/portswigger/sql-injection/write-up-portswigger---sql-injection-union-attack-retrieving-data-from-other-tables/Thu, 21 May 2026 09:12:54 +0900https://blog.mingon.dev/write-up/portswigger/sql-injection/write-up-portswigger---sql-injection-union-attack-retrieving-data-from-other-tables/앞서 파악한 컬럼 수와 문자열 컬럼을 이용해 users 테이블의 사용자명·비밀번호를 조회하고 administrator로 로그인하는 PortSwigger 랩 풀이https://blog.mingon.dev/write-up/portswigger/sql-injection/write-up-portswigger---sql-injection-union-attack-finding-a-column-containing-text/Thu, 21 May 2026 08:12:44 +0900https://blog.mingon.dev/write-up/portswigger/sql-injection/write-up-portswigger---sql-injection-union-attack-finding-a-column-containing-text/컬럼 수를 파악한 뒤 각 컬럼에 문자열을 삽입해, 문자열 데이터와 호환되는 컬럼을 찾아내는 PortSwigger 랩 풀이https://blog.mingon.dev/write-up/portswigger/sql-injection/write-up-portswigger---sql-injection-union-attack-determining-the-number-of-columns-returned-by-the-query/Wed, 20 May 2026 14:25:12 +0900https://blog.mingon.dev/write-up/portswigger/sql-injection/write-up-portswigger---sql-injection-union-attack-determining-the-number-of-columns-returned-by-the-query/ORDER BY와 UNION SELECT NULL을 이용해 원본 쿼리가 반환하는 컬럼 수를 파악하는 PortSwigger 랩 풀이https://blog.mingon.dev/write-up/portswigger/sql-injection/write-up-portswigger---sql-injection-attack-querying-the-database-type-and-version/Wed, 20 May 2026 14:12:45 +0900https://blog.mingon.dev/write-up/portswigger/sql-injection/write-up-portswigger---sql-injection-attack-querying-the-database-type-and-version/UNION 기반 SQL Injection으로 컬럼 수와 데이터 타입을 파악한 뒤 데이터베이스 버전 문자열을 조회하는 PortSwigger 랩 풀이 (Oracle · MySQL · Microsoft)https://blog.mingon.dev/write-up/portswigger/sql-injection/write-up-portswigger---sql-injection-attack-listing-the-database-contents/Wed, 20 May 2026 14:12:44 +0900https://blog.mingon.dev/write-up/portswigger/sql-injection/write-up-portswigger---sql-injection-attack-listing-the-database-contents/메타데이터 뷰(information_schema, all_tables)를 조회해 사용자 계정 테이블과 컬럼을 열거하고, administrator의 비밀번호를 탈취해 로그인하는 PortSwigger 랩 풀이 (non-Oracle · Oracle)https://blog.mingon.dev/analysis/analysis-quine-sql-injection-%EB%B6%84%EC%84%9D/Sat, 17 Jan 2026 19:06:29 +0900https://blog.mingon.dev/analysis/analysis-quine-sql-injection-%EB%B6%84%EC%84%9D/Quine SQL Injection의 페이로드를 분석하고, 해당 기법이 왜 그리고 어떻게 동작하는지 분석