Understanding the order by clause used in SQL Injections

Question

I am trying to enumerate a database, created specifically for the purpose of learning SQL injections. I am trying to discover the number of columns a particular select statement might be using. I do this by "Ordinal" ordering the result set. So, I start with ORDER BY 1, .. BY 2, and so on until I get an error returning 'Unknown column'. Now, for an injection like so:

localhost/sqli?id=2' order by 7 AND '1

The resulting SQL statement is:

mysql> SELECT * FROM table_name where id='2' order by 7 and '1';

This returns a result set, but I was expecting it to throw an error returning "unknown column '7' in 'order clause' ". Why does it not throw the error. The table that I am working with has only 3 columns.

Answer 1

If you look at the syntax of ORDER BY clause for the SELECT statement, it states:

[ORDER BY {col_name | expr | position}
  [ASC | DESC], ...]

So you either specify a columns name (col_name), an expression (expr), or a column position (position), where column positions are integers.

Now if you compare this syntax with your ORDER BY clause:

… order by 7 and '1'

7 and '1' is an expression, consisting of an AND operation with 7 and '1' as operands.

However, the following works as expected:

… order by 7, '1'

Where 7 is a column position and '1' is an expression.

Answer 2

I think enumerating the number of columns is not what this is doing because for that we don't need a "'" in the order by injection as we don't want the application to throw an error except when the injection exceeds the number of columns in the original select statement. Moreover, I think you should use commenting out the rest of the statement after order by.