I have an SQL injection in a query where I control the sort direction parameter i.e: SELECT * from x where y=y ORDER BY COLUMN_NAME [SORT_DIRECTION]

When I control the SORT_DIRECTION, which is normally ASC or DESC, how do I turn this into a blind SQL injection?

  • how about UNION SELECT * FROM z WHERE ...? does it have to be blind? if you can't see the output there's no point letting you control the sort order
    – user253751
    Oct 12 '20 at 12:15
  • 2
    I don't think union is going to work, the ORDER BY clause would have to go at the end of the statement. The ORDER BY clause can nonetheless be exploited, see for example: notsosecure.com/injection-in-order-by-clause
    – Kate
    Oct 12 '20 at 19:52

Found a partial solution:

,if(1=(select 1 regexp if(1=1,1,0x00)),1,1) = TRUE
,if(1=(select 1 regexp if(1=2,1,0x00)),1,1) = FALSE [error]

Works with version() but not with subqueries using SELECT.

  • Please do not ask subsequent questions in your answers.
    – schroeder
    Oct 20 '20 at 7:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.