Comments on: Injection in Order by, Group by Clause

By: GDSG

GDSG — Thu, 08 Jul 2010 02:17:27 +0000

THANKS MAN!!!
I try to figure this out about 2 days, cuz IF(1=1,1,1) not worked, but this ROCKS.

Thanks Again!

By: Lord

Lord — Tue, 21 Apr 2009 14:34:57 +0000

of course -.-’
Thank you.

By: sid

sid — Fri, 17 Apr 2009 15:00:13 +0000

This is how, you can convert this into standard true and false responses. Think of that error as a ‘false’ response which you get when doing boolean injection;

e.g. id=100 and 1=1; id=100 and 1=2;

—-

By: Lord

Lord — Thu, 16 Apr 2009 22:07:52 +0000

Server Version: 5.1.30
I meant especially the “order by”-case.
What happens is exactly the shown reaction. What does that error tell me (regarding the injection)?

By: sid

sid — Thu, 16 Apr 2009 08:32:31 +0000

what version of the mysql are you trying this?

I think this doesnot work in some of the recent versions

By: Lord

Lord — Wed, 15 Apr 2009 20:59:33 +0000

Great. Thats exactly what I was searching for.
Not so great: I do not understand what the example should do…