2

I am trying to enumerate a database, created specifically for the purpose of learning SQL injections. I am trying to discover the number of columns a particular select statement might be using. I do this by "Ordinal" ordering the result set. So, I start with ORDER BY 1, .. BY 2, and so on until I get an error returning 'Unknown column'. Now, for an injection like so:

localhost/sqli?id=2' order by 7 AND '1

The resulting SQL statement is:

mysql> SELECT * FROM table_name where id='2' order by 7 and '1';

This returns a result set, but I was expecting it to throw an error returning "unknown column '7' in 'order clause' ". Why does it not throw the error. The table that I am working with has only 3 columns.

  • Not sure why it doesn't error out, but I think what you'd want to do is comment out the remainder so your order by is the last part of sql. I.e. localhost/sqli?id=2' order by 7 -- – LB2 Apr 24 '14 at 19:30
  • The scenario is that commenting out the rest of the SQL isn't an option. This is the video tutorial I am following - youtube.com/watch?v=0tyerVP9R98 – user1720897 Apr 24 '14 at 19:34
  • Try running EXPLAIN on the query: EXPLAIN SELECT * FROM table_name where id='2' order by 7 and '1'; – user43488 Apr 24 '14 at 19:39
  • 1
    Running EXPLAIN on it returns - id 1, select_type SIMPLE, table table_name, type const, possible_keys PRIMARY, key PRIMARY, key_len 4, ref const, rows 1, Extra NULL. I am not sure what to make of the output. – user1720897 Apr 24 '14 at 19:47
2

If you look at the syntax of ORDER BY clause for the SELECT statement, it states:

[ORDER BY {col_name | expr | position}
  [ASC | DESC], ...]

So you either specify a columns name (col_name), an expression (expr), or a column position (position), where column positions are integers.

Now if you compare this syntax with your ORDER BY clause:

… order by 7 and '1'

7 and '1' is an expression, consisting of an AND operation with 7 and '1' as operands.

However, the following works as expected:

… order by 7, '1'

Where 7 is a column position and '1' is an expression.

1

I think enumerating the number of columns is not what this is doing because for that we don't need a "'" in the order by injection as we don't want the application to throw an error except when the injection exceeds the number of columns in the original select statement. Moreover, I think you should use commenting out the rest of the statement after order by.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.