Waraxe IT Security Portal

panzerstar · Beginner

Hello,

Here http://www.waraxe.us/advisory-47.html I've found this:

http://localhost/nuke78/?kala=p0hh+UNION+ALL+SELECT+1,2,3,pwd,5+FROM+nuke_authors/%2a

I cannot understand why or what happens when you enter 1,2,3,4,5 or even 1,2,3,pwd,5 instead of * or ascii. I think realnames arent called like this.

A small example to following what happens would be very nice.

Thank you for spending time to answer my question

greetings panzer

panzerstar · Beginner

Re,

Nobody can help? Here is an additional part, sometimes the 1's are replaces with 0's, why?

greetings

Classics · Regular user

to make this request in the Search field... of vuln Page!

as a result of MD5 Hash Wink

greetz

Slodave · Beginner

Using 1,2,3 is only way to execute UNION statement because union all need's to have same fields as select statement (if you use * it seclect all). Using numbers is good because you don't need to wory about field type.
Hope it helps.

waraxe · Site admin

There are many reasons and any pentester or software security auditor has some personalized habbits in sql injection testing and exploiting area.
Yep, the classical UNION exploiting scheme --> "count of columns does not match", and when it will finally will match, then all the fields must be same type. Sql injection whitepapers suggest to use "UNION ALL SELECT null,null", but if we use "UNION ALL SELECT 1,2,3,4,5,6,7", then we can see by feedback, what sql fields are rendered in what position in html code. So it is faster than "null, null, null" and then "1,null,null" and then "null, 2, null" etc.
Of course, there can be many problems in real life exploiting.
One example: