The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

or an empty string.

Continued

70779c09.qxd:WileyRed  9/14/07  3:13 PM  Page 253

---

254

Chapter 9 

■

Injecting Code

HACK STEPS (continued)

■

You can inject an 

ORDER BY

clause into the original query and increment

the index of the ordering column until an error occurs. For example:

‘ ORDER BY 1--

‘ ORDER BY 2--

‘ ORDER BY 3--

Typically, the first few cases will return the same results as the original query

but in different orders. When an error occurs, you have specified an invalid

column number, and so have discovered the number of actual columns.

Having identified the required number of columns, your next task is to

discover a column that has a string data type, so that you can use this to extract