I am trying to find a POC for an SQLI vulnerability, the backend db is Mysql on ASP.net

using order by works fine, but union select give a 500 internal server error (which produce if there was any other error or miss typed something)

what is the cause of the error and how can I bypass it ?

  • It would be a lot easier to tell what the error in the query was if we knew what the query was. – Boycott SE for Monica Cellio Nov 25 '16 at 16:03

Just to be clear, are you using the "order by" to get the number of columns and then using that number in your "union select"?

As an example, if there were 7 columns then the correct "union select" would be something like this:

  • ' UNION ALL SELECT 1,database(),3,4,5,6,7 -- -
  • ' UNION ALL SELECT 1,database(),3,4,5,6,7#

Also, the "order by" is used to get the number of columns in that you will increase the "order by #" until you get an error and the number before the error is the number of columns. You probably know this, but wanted to add it.

|improve this answer|||||
  • Yes, I do , using ?id=1+order+by+2 -- works perfectly, but using union select 1,2 -- -produce the error, I have some knowldge when it comes to SQLI I just might not be able to express it right, comments and everything else works fine, there are no filtered words or any WAF , using Sqlmap wth filters didn't help me either – crismatiq Nov 25 '16 at 15:08
  • I don't see that you are using a single quote in your injection or did you just forget and leave that out? Typically the flow of a sql injection is to first get an error by supplying a single quote for example: – Beetle Nov 25 '16 at 15:18
  • id=' is the example, then do id=' order by 1# then id=' order by 2#, etc until you get an error that says the column number doesn't exist. After you have the column number, you can the proceed to union select. – Beetle Nov 25 '16 at 15:20
  • single quote is not necessary in this case, because it is not used for the id, so we don't need to close the quote – crismatiq Nov 25 '16 at 15:22
  • hmmm okay...well at what point do you get an error with the "order by" to know how many columns there are? – Beetle Nov 25 '16 at 15:42

Your Answer

