0

I am learning web development and at the same time I want to learn web hacking in order to better protect my websites in the future. Now I learning SQL injection and I am hacking into a hackme domain. Even though it is vulnerable, when I run this order by query:

http://www.hackmedomain.gr/news.php?id=4842 order by '1000'

I get this result:

Query failed: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1000''' at line 1

If I use order by 1 I get the same thing. What I am doing wrong?

Improve this question
4
  • Do not put quotes and you start ordering by 1 until you hit an error
    – Tryna Learn Somethin
    Jan 2, 2018 at 11:32
  • i think that this question is an overkill for SE.I didn't downvote your question because it can be discussed if it really is or not.
    – AXANO
    Jan 4, 2018 at 7:17
  • This is not overkill - it is just not on topic as it has nothing to do with security. You have simply made an SQL syntax error.
    – Rory Alsop ♦
    Jan 4, 2018 at 9:36
  • Why it isn't considered a security-related topic ? I had an issue exploiting an SQLi, and as it turned out the problem was mainly due to the fact that the site had some kind of protection against the "order by" clause (check the accepted solution and my comment bellow it). Isn't SQL Injection & protection bypass a pentesting related subject ? Anyway, it isn't a secret that over-moderation in these stackoverflow and stackexchange sites results in many questions getting locked up even if they don't deserve it. I just hope that it will help some people since this is not an uncommon problem.
    – Revolution
    Jan 4, 2018 at 10:23

1 Answer 1

Reset to default
1

As @tryna-learn-somethin mentions in comments, the likely source of the problem here is that you appear to be enclosing the order by column in single quotes, which are likely not necessary and getting treated as a SQL syntax error.

If you look at examples like the ones in this answer you should be able to construct a valid example for this injection point.

Improve this answer
1
  • 1
    You are right, BUT, as it seems my query didn't worked because the site had some "security" measures too. After spending a few hours i found out that sometimes you need to "obfuscate" the query in order to bypass these measures. These measures may be that the query doesn't do anything even though the URL is vulnerable, or it shows an "connection reseted" error. In the future if someone has trouble with this thing he can check this link that explains the above technique/procedure.
    – Revolution
    Jan 2, 2018 at 23:56

Not the answer you're looking for? Browse other questions tagged .