Like the guy in this thread : Error-based SQL injection I understand the idea behing SQL Error-Based Injection but not how it works on the MySQL server.
or 1 group by concat_ws(0x3a,version(),floor(rand(0)*2)) having min(0) or 1--
Because we are on a WHERE clause, the
or 1is here to cancel the previous condition and display many rows.
concat_ws()is a function that take the first argument as separator and other arguments are the ones concatenate using the separator.
0x3ais the hexadecimal for
:- So colon is the separator
version()kinda obvious, display the MySQL version
floor(rand(0)*2)Round the result of
rand(0)*2downward to its nearest integer
Now the big question is why this query display :
Duplicate entry '~'5.x.xx'~1' for key 1
And what is that having min(0) for ?
When I tried this using my computer :
Result is just
So how the MySQL server interpret this query and how the duplicate things works ?
Thanks in advance.