Web Penetration Testing with Kali Linux - Third Edition

Extracting data with SQL injection

In order to take advantage of an SQL injection vulnerability and extract data from a database, the first thing that you need to do is to understand how the query is built, so you know how and where to inject your payloads.

Finding out that there is an injection vulnerability helps you figure out how the WHERE condition is made. Another thing that you need to know is how many columns are selected and which ones are actually returned to the client.

To get the number of columns, you can use ORDER BY. Start by injecting ORDER BY 1 after the valid value to order the results by the first row, then by the second row, and so on until you get an error because you are trying to order the results using a nonexistent ...