Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
A PHP website ends with php?id=1 and when I place a tic it prints this error:
Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /home/otmsm/public_html/bonnes_adresses.php on line 75
The problem is when I wish to enter ORDER BY 100-- after (link should be php?id=1 order by 100--) it doesn't change the page and still has the same error printed at the screen... So, the question is: how do I know how much tables there is?
The error you get from the page has nothing directly to do with your SQL injection attempt. The site appears to employ a simple casting to ensure id is numeric, so your query becomes a valid query which returns nothing unless you send in a plain number:
$id = (int)$_GET['id'];
In other words, not all queries you can mess up from the URL line are automatically fully SQL injectable.
The error you get is the one from the query returning nothing, because there are no rows with a type of zero.
This kind of "simple whitelisting" is just not exploitable, because the exploit will never reach the SQL layer; even if other parts of the web site might well be (the use of mysql_* functions and the lack of checks for query failure are not good signs).
However, I think it would be way better to look for some SQL injection testing website (I knew of one but it is now apparently offline, the domain for sale) and leave the good people of Montreuil-sur-Mer alone with their bonne adresses. In a pinch, there are several tutorials that you can deploy to a virtual machine to test the different approaches and the different SQL platforms.
The error you see is the result of a failed query. This is most likely due to incorrect data being fed to the query string, it's possible mysql_real_escape_string() is being used to escape SQL characters (that would be used in an attack) which would explain why your injection attempt failed. Though more likely would be your incorrect attack attempt. We would need to see your exact attack query to know what is going on. If you have access to this system, obviously you can check for mysql_error. If you don't have access to this system, do note it may be illegal to perform an attack on this computer system without permission from the system's owner.
