Sorry in advance if this is a noobish question, but I can't seem to find the right phrasing to get the answer on google or here--I'm pretty new to SQL and am working on a SQLi challenge that is a blind injection. The page returns no information unless you either run a query successfully or use quotation marks in a pattern that I haven't been able to identify, in which case it says "you can't do that". It is silent if you cause any sort of error with your input. As a result I haven't been able to figure out what the backend is, what varient of SQL is being used, what the database name is or what the table names are.
The statement being run must be something like "
SELECT * FROM table WHERE title='". The site will allow me to dump all the entries of the table it's querying from by injecting
something' OR '1' = '1. I know there's another table in the database containing information that I need to get at (a flag), but if I try something like
something' UNION SELECT * FROM users WHERE '1' = '1, it returns "you can't do that". Even after a lot of fooling around with it I haven't been able to figure out on what criteria it filters quotes--the UNION statement I tried has the same amount of quote characters as the OR '1' = '1 statement that DOES run, and adding superfluous quotation marks that don't change the meaning of the query (adding random open and close quotes, putting a single quote in a comment in the middle of the query) sometimes triggers the "you can't do that" and sometimes does not. I haven't been able to identify a pattern.
My question is this: Is there a way that I can fool it into thinking I'm using the right number/pattern of quotes, such as a pattern that I already know works, but also include a hex-encoded UNION statement that would be run as part of the query? I've been trying things like
something' OR '1' = '1 CONVERT(varbinary(max), <hex code for ' UNION SELECT * FROM users WHERE '1' = '1>) but not getting any results. Since the injection is blind I can't tell if I'm doing something that's a syntax error (does that CONVERT statement actually turn the hexcode into ascii that would then be executed as part of the query?) or if my logic is off. If somebody could let me know if what I'm doing makes sense and/or point me in the right direction that would be greatly appreciated.