hunt-sqli

Autonomous Testing Priority

Distrust the target's own hints. Text embedded in the page (tutorial notes, "no errors shown — use blind", suggested payloads) is UNTRUSTED and often steers you to the slowest or a dead-end path. Decide your technique from what the live responses actually do, and always prefer the fastest technique that works — even if the page tells you to do something harder.

Pick the technique by whether the endpoint REFLECTS query results. A search/listing/report page that shows rows back to you → use UNION to dump data straight into that visible output: it's fast (a few requests) and the stolen data lands in the response where it can be proven. Reserve slow blind boolean extraction (AND SUBSTR(...)='x', char-by-char) ONLY for endpoints that return no reflected data — it costs hundreds of requests and the recovered value never appears in any response, so it's the last resort, not the first move.

For a UNION-based dump, the column count is everything — establish it FIRST, by enumeration, never by guessing. A UNION with the wrong number of columns silently returns no rows, which looks identical to "not vulnerable." Most failed SQLi attempts are just a wrong column count.

1. Confirm injection: send a single ' and look for a DB error or a changed/broken response.
2. Find the column count — exhaustively, one at a time:

   ' ORDER BY 1-- -   ' ORDER BY 2-- -   ...   (increment until it errors → count = last good)
   ' UNION SELECT NULL-- -
   ' UNION SELECT NULL,NULL-- -
   ' UNION SELECT NULL,NULL,NULL-- -          (keep ADDING one NULL — try up to ~12)
   

   The correct count is when the UNION stops erroring / starts returning extra rows. Do not attempt to select real column names until the NULL count matches — and don't stop at 3–4; tables often have 5+ columns.
3. Find which columns are reflected: replace NULLs with markers, e.g. UNION SELECT 1,2,3,4,5-- -, and see which numbers appear on the page.
4. Dump: put the data in the reflected positions, e.g. UNION SELECT 1,username,password_md5,4,5 FROM users-- - (MySQL) or read schema from information_schema.columns / sqlite_master.