Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

After scanning my website with uniscan I found a few vulnerabilities. I found this answer here and tried but it does not return anything except what it should return.

Blind SQL Injection:

[+] Vul [Blind SQL-i]: http:/'+AND+'1'='1     
[+] Keyword: Compassion

How to use the keyword in order to inject successfully?

share|improve this question
Do you get a different result with 10590' AND '1'='0? – Gumbo Apr 30 '14 at 8:02
No, i get a different result if i write id=10590 only http:/ – FilipLuch Apr 30 '14 at 8:04
If 10590' AND '1'='0 and 10590' AND '1'='1 don’t have different results, you’re probably not vulnerable. Or what exactly is the difference in both? – Gumbo Apr 30 '14 at 8:05
user_id=10590 != user_id=10590'+AND+'1'='1 == user_id=10590'+AND+'1'='0' does that make the website vulnerable? – FilipLuch Apr 30 '14 at 8:12
The expression '1'='1' in 10590' AND '1'='1 would make the condition true for each row while '1'='0' would be false for each row. If you don’t get a different result, it’s not vulnerable. That 10590 and 10590' AND '1'='1 gives you different results is probably because there is no user with the id 10590' AND '1'='1. – Gumbo Apr 30 '14 at 8:17
up vote 1 down vote accepted

What the vulnerability scanner tried is to add a condition that is either true for all rows ('1'='1', tautology, added with 10590' AND '1'='1) or false for each row ('1'='0', contradiction, added with 10590' AND '1'='1). If you don’t get a different result for these, it’s probably not vulnerable.

However, that the user_id values 10590 and 10590' AND '1'='1 gives you different results is probably because there is no user with the ID 10590' AND '1'='1.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.